SSL/TLS Certificates Explained for Business Websites

By Grocito16 October 2026

An SSL/TLS certificate lets browsers connect to your website over HTTPS, which encrypts the traffic, protects it from tampering and confirms the site belongs to the domain shown. Every business website should use one. Most hosts now offer free, automatically renewed certificates, so the real work is installing correctly, redirecting HTTP to HTTPS, fixing mixed content and monitoring expiry.

Key takeaways

HTTPS gives you three things: encryption, integrity and identity. It does not make a site safe from every attack.
SSL is the old name. The protocol in use today is TLS, though people still say SSL certificate.
Domain-validated certificates prove control of a domain, not that a business is trustworthy.
Free automated certificates are a perfectly good choice for most business sites. Paid options add support, warranties or validation of the organisation.
Expired certificates cause alarming browser warnings, so automate renewal and monitor expiry.
After installing, redirect HTTP to HTTPS, fix mixed content and consider HSTS.

What do HTTPS and TLS actually do?

HTTPS is ordinary web traffic wrapped in TLS (Transport Layer Security). When a visitor loads your page, the browser and server agree on keys and set up a protected channel. That delivers three things:

Encryption. Anyone watching the network, such as on public Wi-Fi, cannot read the data, including form entries and login details.
Integrity. The content cannot be changed on the way without being detected, so nobody can quietly inject ads or malicious scripts.
Identity. The certificate shows that the server answering is authorised for your domain name.

SSL or TLS: which word is right?

SSL (Secure Sockets Layer) was the original protocol and has long been replaced by TLS. The name stuck, so hosting panels and vendors still say SSL certificate. Whenever you see either term, the technology in use is TLS. Old SSL versions and early TLS versions are considered insecure, so ask your host to disable them.

What types of certificates are there?

Certificates differ by how much checking the issuer performs before signing.

Domain validated (DV)

The authority only checks that you control the domain, usually through a DNS entry or a file on the site. It is quick, cheap or free, and suitable for most business sites.

Organisation validated (OV)

The authority also verifies that a real organisation is behind the request. Details can appear in the certificate, but most visitors never look.

Extended validation (EV)

This involves the most thorough identity checks. Browsers no longer give EV certificates the prominent visual treatment they once did, so the practical benefit is smaller than it used to be.

What do certificates prove, and what do they not?

A certificate shows that traffic is encrypted and the domain matches. It does not show the business is honest, the site is free of malware or the software behind it is secure. Phishing sites also use HTTPS, so the padlock should never be read as a character reference.

Free or paid certificates?

Free certificates from public authorities that automate issuing and renewal are widely used and trusted by browsers. For many business websites, they are enough. Consider paid options when you need:

Organisation validation required by a customer or contract.
A warranty or vendor support with defined response times.
A certificate that fits specific device or compliance requirements.
A certificate managed centrally across many servers.

Encryption strength is not the main difference. The difference is validation, support and management features. Do not buy an expensive certificate on the belief that it makes a site more secure. Check current terms with each authority before relying on them.

Who issues certificates?

Certificates are signed by certificate authorities (CAs), organisations that browsers and operating systems trust. A browser holds a list of trusted root authorities. Your certificate is usually signed by an intermediate authority, which in turn chains back to a trusted root. If a server does not present that chain correctly, some browsers and apps show errors even though the certificate itself is valid.

How do I install a certificate?

The route depends on where your site is hosted.

Hosting control panel. Many hosts have a one-click option that issues and renews a certificate for your domain automatically. This is the simplest route.
CDN or reverse proxy. A content delivery network can terminate HTTPS at its edge and manage the certificate for you. Remember to secure the connection from the CDN to your origin server as well, otherwise part of the journey is unprotected. Our explainer on how content delivery networks speed up websites covers the idea.
Load balancer or cloud platform. Cloud providers usually offer managed certificates you attach to a load balancer, so renewals happen without touching servers.
Self-managed server. You request the certificate, install it with its full chain and configure the web server. Use an automated client so renewal does not depend on someone remembering.

How much control you have depends on your plan, which is one reason our guide to web hosting types is worth reading before you choose.

Wildcard and multi-domain certificates

Single domain. Covers one hostname, such as your main site.
Wildcard. Covers all subdomains at one level, such as shop and blog under your domain. Handy for many subdomains, but if its private key leaks, every covered subdomain is exposed, so guard it carefully.
Multi-domain (SAN). Lists several different hostnames in one certificate, useful when you run several brands.

Choose the simplest option that covers your actual hostnames, and keep a record of where each certificate is installed.

Redirects, mixed content and HSTS

Installing the certificate is only half the job.

Redirect HTTP to HTTPS

Send every HTTP request to the HTTPS version of the same page with a permanent redirect. Pick one preferred version of your domain, with or without the www prefix, and make the others redirect to it. Update canonical tags, sitemaps and internal links so they use HTTPS directly.

Fix mixed content

Mixed content happens when an HTTPS page loads images, scripts or stylesheets over plain HTTP. Browsers may block them or show warnings, which breaks layouts and weakens trust. Search your templates, database content and third-party embeds for old HTTP addresses and update them.

What is HSTS?

HSTS (HTTP Strict Transport Security) is a header telling browsers to always use HTTPS for your domain, even if someone types the old address. It removes the brief window where the first request travels unprotected. Switch it on only once HTTPS works everywhere, including subdomains you include, because a mistake locks visitors out until the setting expires. Start with a short duration and extend it as you gain confidence.

What are the common certificate errors and fixes?

Expired certificate. Renewal failed or was never automated. Renew, install and set up expiry monitoring.
Name mismatch. The certificate does not cover the hostname visited, for example it covers the bare domain but not the www version. Reissue with all required names.
Incomplete chain. The server did not send the intermediate certificate. Install the full chain provided by the authority.
Untrusted or self-signed certificate. Fine for internal testing, but public visitors will see a warning. Replace it with a publicly trusted certificate.
Wrong date on the visitor's device. Occasionally a device clock is wrong. Rare, but worth asking about when only one user reports a problem.
Mixed content warnings. Update the insecure resource addresses.

Do certificates affect SEO and trust?

As far as is publicly documented, Google has said HTTPS is a lightweight ranking signal, and browsers clearly mark plain HTTP pages as not secure. The practical effect is trust: visitors are far less likely to complete a form or payment on a page that shows a warning. For privacy and security basics, see our website security checklist for business owners.

A worked example

Imagine a small consultancy whose contact form works, yet visitors sometimes see a warning on the services page. The certificate is valid, but the page loads an old logo from an HTTP address, so the browser reports mixed content. The www version also has no redirect, so some links point to a hostname the certificate does not cover. The fix is to update the logo address, redirect all versions to one HTTPS hostname, reissue the certificate to cover both names, and add expiry alerts to the shared team calendar and monitoring tool.

Certificate checklist

Certificate covers every hostname you use.
Full chain is installed and tested.
Automatic renewal is configured and has been tested.
Expiry alerts go to a monitored shared mailbox, not one person.
HTTP redirects permanently to one preferred HTTPS address.
No mixed content on key pages.
Old TLS versions are disabled.
HSTS considered once everything is stable.
Certificate locations and owners are documented.

FAQ

Is an SSL certificate still needed if I do not take payments?

Yes. Any site with a contact form, login or even ordinary pages benefits from encryption and integrity, and browsers warn visitors about sites without HTTPS. It also protects visitors from content being altered on the way.

Are free SSL certificates safe?

Yes, free certificates from well-known authorities use the same encryption as paid domain-validated certificates and are trusted by browsers. The difference is usually in validation level, warranties and support rather than the strength of encryption.

Why does my browser say my site is not secure after installing a certificate?

The most common cause is mixed content, where some images, scripts or styles still load over HTTP. Other causes are a missing redirect, a certificate that does not cover the exact hostname, or an incomplete certificate chain. Check the browser's developer tools to see which resource is the problem.

How often do SSL certificates need renewing?

Public certificates have limited lifetimes, and the maximum has shortened over the years, so renewal should be automated. Check the lifetime your authority or host uses today, and monitor expiry so a failed renewal is caught before visitors see an error.

Next steps

Open your site in a browser, check the padlock on several pages, and test both the www and non-www versions with HTTP and HTTPS. If you find warnings or want expiry monitoring set up properly, see our DevOps services or contact us.